CVE-2026-22895Disclosure(qnap / quftp)

LOWCVSS 4.8 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuFTP Service 1.4.3 and later QuFTP Service 1.5.2 and later QuFTP Service 1.6.2 and later

qnap CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.qnap.com/en/security-advisory/qsa-26-15

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

quftp

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-03-22)
3 total mentions across 2 days

Affected systems

Vendors

qnap

Products

quftp

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-20	1	General1
2026-03-22	2	Disclosure2

Full discourse3 posts

Infoflowcloud@infoflowcloud201d
Disclosure
🚨*CVE* CVE-2026-22895 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the v… https://www.cve.org/CVERecord?id=CVE-2026-22895 ----- Traducción: CVE-2026-22895 Se … http://infoflow.cloud`
Post summary
A newly disclosed cross‑site scripting (XSS) vulnerability CVE‑2026‑22895 affecting QuFTP Service was reported, noting that an attacker with admin privileges could exploit it, but no PoC, exploit code, patch, or active exploitation details were provided.
0000013
61 followersView on X
CVE@CVEnew201d
Disclosure
CVE-2026-22895 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the v… https://www.cve.org/CVERecord?id=CVE-2026-22895
Post summary
The passage announces a new XSS vulnerability (CVE‑2026‑22895) in QuFTP Service, noting that exploitation requires administrator credentials but provides no PoC, exploit code, active usage, or patch details.
00000100
56.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds202d
General
CVE-2026-22895 Cross-Site Scripting Vulnerability in QuFTP Service Enables Admin... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22895 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet lists CVE-2026-22895 as a Cross‑Site Scripting vulnerability in QuFTP Service and provides a link to a vulnerability detail page, but offers no further information on PoC, exploitation, patches, or active use.
0000037
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	qnap	quftp	-	-	-

Explore more

Back to dashboard qnap CVEs quftp vulnerabilities

What researchers are saying

CVE-2026-22895

Infoflowcloud@infoflowcloudDisclosure

A newly disclosed cross‑site scripting (XSS) vulnerability CVE‑2026‑22895 affecting QuFTP Service was reported, noting that an attacker with admin privileges could exploit it, but no PoC, exploit code, patch, or active exploitation details were provided.

CVE@CVEnewDisclosure

The passage announces a new XSS vulnerability (CVE‑2026‑22895) in QuFTP Service, noting that exploitation requires administrator credentials but provides no PoC, exploit code, active usage, or patch details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The tweet lists CVE-2026-22895 as a Cross‑Site Scripting vulnerability in QuFTP Service and provides a link to a vulnerability detail page, but offers no further information on PoC, exploitation, patches, or active use.